feat(seo): add sitemap generator

internal/config/config.go

@@ -66,6 +66,10 @@ type Config struct {
 	// Frontend
 	FrontendURL string // for CORS + reset/verify links in emails
 
+	// RevalidateSecret authenticates BFF→frontend on-demand cache
+	// revalidation pings (POST /api/revalidate). Empty disables the pings.
+	RevalidateSecret string
+
 	// BFF public URL — the externally-reachable origin of this server. Used
 	// to build the OAuth redirect_uri the provider sees (must match the
 	// allow-list configured in the provider's console). In dev this is
@@ -147,7 +151,8 @@ func Load() (*Config, error) {
 		CookieDomain:  getEnv("COOKIE_DOMAIN", ""),
 		CookieSecure:  getEnvBool("COOKIE_SECURE", false),
 
-		FrontendURL: getEnv("FRONTEND_URL", "http://localhost:3000"),
+		FrontendURL:      getEnv("FRONTEND_URL", "http://localhost:3000"),
+		RevalidateSecret: getEnv("REVALIDATE_SECRET", ""),
 
 		BFFPublicURL: getEnv("BFF_PUBLIC_URL", "http://localhost:8080"),